OK, there are millions of Android users and most users put their personal information on their phone. I think any breach here would be considered gravely signif

OK, there are millions of Android users and most users put their personal information on their phone. I think any breach here would be considered gravely significant. Non-Google branded phones get updates far later than their Nexus/Pixel counterparts if at all. Google and carriers drop devices from updates eventually (2ish years) so if you continue to use your device after that, you're playing with fire. That's just covering the delivery mechanism, not the inability to set a encryption password separate from your pin, or the vauge permissions groups, or the fact that all apps can see your global clipboard, etc. If users can't get the newest version of their OS software, then you kind of fail at security 101. Any bug fix only fixes a small subset of your users. At least Windows XP device users knew how long they'd get security updates and had a clear upgrade path afterward. Linux IoT suffers a lot of the the same problems. No one updates embedded devices. You can draw the "nightmare" semantic line wherever you want, of course. IMHO it's not even remotely secure unless you only and always buy the newest Pixel phone directly from Google. Then we can talk about modern Android security issues.